DARPA Looks For Backdoors, Malware In Tech Products
By Mathew J. Schwartz
InformationWeek
The Defense Advanced Research Projects Agency (DARPA) Thursday published details of its new Vetting Commodity IT Software and Firmware (VET) program, which the agency said is designed to find "innovative, large-scale approaches to verifying the security and functionality of commodity IT devices -- those commercial information technology devices bought by DOD -- to ensure they are free of hidden backdoors and malicious functionality."
DARPA's new program seeks to overcome three current, related technical challenges associated with that task: identifying which capabilities in a device could be malicious; using that list as a checklist to assess if any given device actually is malicious; and then using that knowledge to allow a non-technical expert to test every instance of every device before it gets rolled out in a Department of Defense network.
"DOD relies on millions of devices to bring network access and functionality to its users," said DARPA program manager Tim Fraser in a statement. "Rigorously vetting software and firmware in each and every one of them is beyond our present capabilities, and the perception that this problem is simply unapproachable is widespread. The most significant output of the VET program will be a set of techniques, tools and demonstrations that will forever change this perception."
[ Are the Iranians out to get us? See Frankenstory: Attack Of The Iranian Cyber Warriors. ]
The launch of DARPA's new program comes after the U.S. House of Representatives Permanent Select Committee on Intelligence in October 2012 issued a scathing report on Chinese telecommunications companies Huawei and ZTE, saying that they "cannot be trusted to be free of foreign state influence and thus pose a security threat to the United States and to our systems." The committee "strongly encouraged" businesses in the United States to look elsewhere for their technology.
That recommendation was not made based on an inspection of either vendors' firmware code, but rather by reviewing the companies' business practices. Still, the report raised a larger and much-more-difficult question: Did the devices actually contain built-in backdoors?
Unfortunately, answering that type of question can be quite difficult, as it necessitates both a complete review of the code base, as well as the ability to surmise which built-in capabilities may be put to nefarious use. Notably, one independent security expert who closely studied two different models of Huawei routers noted that existing bugs in the firmware, seemingly present due to sloppy coding, would have allowed a would-be attacker to compromise the devices, irrespective of any purpose-designed backdoor functionality being present.
DARPA will host a "proposer's day" December 12 in Arlington, Va., to brief anyone who's interested in participating in its new VET program.
Federal agencies must eliminate 800 data centers over the next five years. Find how they plan to do it in the new all-digital issue of InformationWeek Government. Download it now (registration required).
As malware gets increasingly sophisticated, so, too, must the technology and strategies we use to detect and eradicate it (or, better yet, stop it before it ever makes it onto network systems). Our Rooting Out Sophisticated Malware report examines the tools, technologies and strategies that can ease some of the burden. (Free registration required.)
 |
To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. |
Subscribe to RSSInformationWeek Reports
Cloud Implementer's Checklist
Once your agency has completed the business case for a private cloud, how do you actually move ahead with your data center transformation? Our report provides a practical set of steps to get you there, including a "to do" list that will be helpful to anyone on your IT team who's involved in the project. By the time you're done, your data center should be home to a more flexible, on-demand IT services.
Cloud Compliance in Government
Compute clouds created for government data centers must adhere to a range of specifications designed to support data and system security, privacy, and governance. FISMA, HIPAA, SOX, and SAS 70 are just some of the requirements that have to be taken into account as federal IT pros deploy a shared-services cloud model. In this report, we identify the key specs that need to be factored into any federal cloud architecture.
Government Cloud Platform Strategy
This report analyzes the key IT infrastructure considerations that must be taken into account for implementing cloud services in federal data centers: software/hardware environment, multi-tenancy, security, virtualization, and management tools. We also explain the key important role that APIs play in supporting hybrid scenarios that tap into public cloud services.
The Business Case for Government Clouds
This report assesses usage scenarios, barriers, and other variables that factor into the decision of whether and how to implement cloud computing in federal environments.